Audit Rules File

An audit rules file determines what files and file attributes to audit on a managed host. The audit rules file serves two purposes:

• To specify which files and directories to catalog when building a manifest for a managed host

• To specify which files, directories, and file attributes in the manifests to compare when auditing managed hosts

For example, you might want to ignore the directory modification time for files. The modification time changes each time a file is created or deleted in the directory. You might also want to ignore core files or .o files.

The format of the audit rules file is described in Audit Rules File Format. The audit rules file name must use the .brul suffix.

To create or import a rules file from another system, see How to Create an Audit Rules File (Web Browser) and How to Import an Audit Rules File to the Change Manager Repository (Web Browser) or How to Import Audit Rules Files to the Change Manager Repository (Command Line).

To build manifests of managed hosts, see How to Build Manifests for Managed Hosts (Web Browser) or How to Build Manifests for Managed Hosts (Command Line).

To audit managed hosts, see How to Audit Managed Hosts (Web Browser) or How to Audit Managed Hosts (Command Line).

To import a manifest to the repository, see How to Import a Manifest to the Change Manager Repository (Web Browser) or How to Import Manifests to the Change Manager Repository (Command Line).